The DMZ

AstroDan

03:10

What happened to this place?

bilbo_pingouin

05:21

people were in week end?

bilbo_pingouin

07:02

I am wondering how that question security.stackexchange.com/questions/120701/… got 20+ upvotes. Is that meant as a general thinking exercise and I am missing it?

M'vy

07:16

morning

Rоry McCune

mornin'

HamZa

08:08

morning

JukEboX

12:49

Happy Monday all who enjoy donuts and infosexs

Rory Alsop

Happy Monday @Juke

@bilbo_pingouin HNQ - that's what happens...

Journeyman Geek

yup

or worse ;p

Rory Alsop

13:07

@schroeder - that ransomware answer has a lot of flags. Are you happy it isn't a troll?

-1

A: What should you do if you caught ransomware mid-operation?

The best thing to do is nothing. Doing something stupid might lead to data loss or corruption. Let it finish and then contact the people listed there, pay the ransom and you are good to go. We are professionals and will help you get your files back. Disclaimer: I am a ransomware developer.

Journeyman Geek

lol

M'vy

13:23

> pay the ransom and you are good to go. We are professionals and will help you get your files back.

pls

Thomas Pornin

@RoryAlsop This looks like a genuine promotion of the service, disclosed in all honesty.

M'vy

> Doing something stupid might lead to data loss or corruption.

that's actually, true, but...

doing nothing also leads to data loss in the end.

Thomas Pornin

Yes, it is called entropy.

M'vy

:)

Rory Alsop

13:38

I'm reading it as the writer is actually a ransomware developer and is being open about it

RoraΖ

13:51

0

Q: Few questions about verifying a DLL signature?

i have few questions about verifying a file's certificate. The use case is as follows: i have a DLL file that contains a resource i need. I'm signing the file with a code-signing certificate, and then my application needs to load it (dynamically) and use the resource within. the DLL is also time...

What's the point of code signing if you're going to support expired certificates?

Thomas Pornin

@RoraΖ It is OK (even on a theoretical basis) if you time-stamp the signature and all relevant extra certificates and CRL before expiration.

But then you have to mind about expiration of the TSA certificate.

AstroDan

@RoraΖ I think that he means having the signature remain valid after the certificate expires, which is the whole point of time stamping.

Thomas Pornin

Windows has the habit of trusting time stamps after expiration of the TSA certificate, because 1. Microsoft considers that they would be made aware out-of-band of TSA compromises, and 2. it is not really workable, in a business way, to require re-timestamping on a regular basis.

orlp

I have a keyed PRF with a tweak (let's say HMAC-SHA256 using concatenation for the tweak), and I want to generate F(x, i, k) where x in the input, i is the tweak and k is the key, for i = {0, 1, 2, ... , n-1}, such that F(x, i, k) is a fair coin toss not predictable without knowing the key

can I use the full output of HMAC-SHA256 to generate 256 coin tosses at once?

Ohnana

ew math

orlp

13:59

or must I only take one bit output per hash, and discard the rest?

Ohnana

jk lol

someone around here should be able to answer that intelligently

Thomas Pornin

@orlp: if you get an actual case where using all 256 bits is not safe, then congratulations, you just found a very interesting property on SHA-256 and you should publish it.

orlp

I figured, just wanted to make sure :)

Thomas Pornin

If you want a more "formal" explanation, lookup HMAC_DRBG, an HMAC-based pseudo-random number generator.

orlp

well, HMAC was just an example

I was more thinking of using SipHash

Thomas Pornin

14:02

Requiring all 256 bits to be indistinguishable from 256 independent random choices is exactly the same notion as requiring your F function to be a secure PRNG.

orlp

@ThomasPornin the reason I'm doing this is to generate the coin flips for Sometimes‐Recurse Shuffle

@ThomasPornin are you familiar with Sometimes-Recurse Shuffle?

one thing isn't immediately clear to me, whether F_1 to F_r are to be considered secret or not

RoraΖ

@AstroDan Ah, I must have mis-interpretted

Thomas Pornin

@orlp Yes they are.

They are like your subkeys.

orlp

@ThomasPornin all right, the reason I got confused is because you also have K_i, which make it seem like that's the (sole) key

StackExchange

14:18

No, a hydroplane doesn't land on water--that's an aquaplane. A hydroplane is a plane that gets electric power from an onboard water reservoir with a tiny dam and turbines.

orlp

I just realized I'm an idiot, and you can't generate multiple coin flips at once

@ThomasPornin do there exist faster PRFs if they only need to output a single bit?

Iszi

@StackExchange What's up with Randall and the lag lately? He used to be pretty dead-on to midnight (U.S. Eastern) on his releases, or at least some hour before most people are at work.

AviD

@StackExchange its funny, thats how a lot of infosec practitioners are. They just assume they know what they're talking about, even when they spout moose-flavored maple syrup.

Journeyman Geek

hmm. Moose flavoured maple syrrrruuupppp

orlp

14:33

not to be confused with maple flavoured moose syrup

Iszi

Or syrup-flavored maple moose.

Rory Alsop

Mmmmmmmmm

AviD

@orlp hmm that might have been the one I meant

which is the one that comes out the back of a diarrhetic canadian elk?

AstroDan

This whole syrup things sounds like a euphemism for something dirty.

Iszi

@AstroDan Welcome to The DMZ.

Thomas Pornin

14:47

@orlp You cannot really get faster than a hash function there -- SipHash is supposed to be better for short inputs, but if you get to the 400+ bit range, then a "normal" BLAKE2 or similar ought to be about the best you can hope for.

orlp

@ThomasPornin I might even use HChaCha, as my input is pretty much constant size, I don't need a compression function, only a PRF

Journeyman Geek

@AstroDan I'm shocked sir. SHOCKED.

AstroDan

@JourneymanGeek In my defense I seem to recall a similar phrase from a tv show that was used to describe certain... activities preformed in Canada.

Ohnana

15:14

HChaCha? are you trollin?

Xander

@AviD I think that's an affliction of smart people, generally. Smart people tend to assume "Hey, I'm smart, my insights on [topic] must be valuable to the world at large, which isn't as smart as me." Unfortunately, that's usually wrong.

AstroDan

15:42

This place seems oddly quiet.

M'vy

15:53

So we're keeping the malware answer at the end?

CodesInChaos

@Ohnana Why?

AviD

16:11

@Xander and of stupid people, for obvious reasons.

schroeder

@RoryAlsop I'm happy that it's a reasonable enough course of action. Troll or not, it's a valid way to handle the situation. No one else mentions that trying to meddle with the process might cause more problems than it solves (I know that I hadn't considered it)

CodesInChaos

16:43

Hibernation should be pretty harmless, unless the ransomware detects it and deliberately punishes you for it.

At least for file based encryption, full disk encryption could be tricky.

AstroDan

I have reversed engineered a few ransomware programs and was fairly surprised by how simple they are. I think that complexity gets in the way of their business model. If they kill the system or reinfect they will not get their money. Plus it costs more to add fancy bells and whistles.

Xander

@AviD True. My observation, however, is while less intelligent people are happy to declare whatever it is they believe about [topic], more intelligent people have a greater tendency to insist that you should believe whatever it is that they believe about [topic], and if you don't, if can't be because you have a better (or different) understanding of [topic], but that that you simply can't recognize the superiority of their opinion.

Just an observation, of course.

@AstroDan It's all about doing just enough to make the system work. Least amount of effort possible.

Ohnana

17:09

@CodesInChaos it was tongue in cheek. HChaCha sounds like a silly name for a crypto... thingy.

Aaron Hall

17:19

github.com/NoviceLive/bintut

Any thoughts about the above ^^^?

Ohnana

> Teach you a binary exploitation for great good.

Yes ! I will hack all for justice !

jokes aside, I'm adding this to the portfolio of learning tools

Aaron Hall

um... you're welcome? :)

Ohnana

@AaronHall yes, thank you. I probably won't have time to dig in, but I'll try :)

Aaron Hall

I don't necessarily vouch for it, I was asking for other's opinions too.

I certainly wouldn't run it until I've read the source and am confident it's not going to bork anything up.

Ohnana

or pop it in a VM

the lazy way of doing things

Thomas Pornin

18:49

@Ohnana Silly names are a very important Tradition in crypto.

Jacco

19:09

hi

Thomas Pornin

lo

Iszi

Pretty sure we've got a canonical dupe of this somewhere. Anyone?

5

Q: Server Compromised. Steps to determine further damage on the network?

So one of your servers is compromised. You determine this because you notice a weird process running (as root, unfortunately). No helpful information about this process from Googling around. First things first, let's clean this known dirty server up. Nuke it from orbit, see ya later. How do I d...

incident-response

Ohnana

19:44

i am 100% sure we do

i forget where it is tho

Rоry McCune

@RoryAlsop @AviD @schroeder mody type, we may need a clean-up on isle 3 (a.k.a this answer) security.stackexchange.com/a/120733/37 getting a load of chatty comments

Iszi

20:06

@RоryMcCune I'd help, but "protect" only hits questions to slow down the answer rate. Doesn't cut back on commentary at all.

Rоry McCune

yeah we need the big guns

get in there and earn their $mod_salaries!

AviD

20:31

well, started with a protect anyway...

> I know this sounds really paranoid, but let's not discuss it and instead assume that what I say is true.

also, dat qweschun...

already sounds like it would be better on Worldbuilding

Ohnana

@RоryMcCune aisle 3 you goof

AviD

btw @RоryMcCune upvoted for the rickroll.

Ohnana

it's referring to supermarkets not landmasses

Rоry McCune

@Ohnana pls

@AviD yeah I got at least one person with it :)

AviD

@Ohnana something something @Simon's mom.

@RоryMcCune +1

AviD

20:50

pshaw I'm digging thru all those comments but getting weird errors, only to find that @schroeder already ninjad me and cleaned em out... :P

AstroDan

@AviD Don't ping @Simon's mom, she is busy with... other pursuits.

Rory Alsop

I was slow because I'm at a chip shop in the middle of nowhere with very bad signal

AviD

@RoryAlsop you're getting chipped??

schroeder

@AviD Won't see me coming - til I strike!

AviD

@schroeder you talking about @Simon's mom again?

schroeder

20:55

Gankutsuou: The Count of Monte Cristo

Gankutsuou: The Count of Monte Cristo (Japanese: 巌窟王, Hepburn: Gankutsuō, literally The King of the Cavern) is an anime series loosely based on Alexandre Dumas's classic French novel, Le Comte de Monte-Cristo. Spanning 24 episodes, it was produced by Gonzo, directed by Mahiro Maeda and broadcast by Animax across its respective networks in Japan, East Asia, Southeast Asia, South Asia, Latin America, and other regions. Gankutsuou's unusual visual style layers Photoshop textures into digital animation, with backgrounds often rendered in 3D. Gankutsuou is set in the far future, during the year 5053...

theme song

Rоry McCune

21:11

@RoryAlsop mmmm chip shops (not that I'm on a diet or anything)

Rory Alsop

21:33

Was good @Rоry. I bought a black pudding supper, king rib supper, fish supper, chicken and a battered sausage supper

The kids are now happy

AviD

ahh that kinda chips

Rory Alsop

@AviD yeah - I don't need no performance mods

AviD

ooh, whats performance.se? sounds even better than productivity.se.

Rory Alsop

lol @ dad joke

AviD

oops

dammit

cuz like, you said "performance mods", and I took that as "se moderator"

^ making it even daddier

Rory Alsop

21:42

hahahahahahahaha

Transcript for